[lkml]   [2011]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [patch] cpusets, cgroups: disallow attaching kthreadd
On Tue, 11 Oct 2011, Peter Zijlstra wrote:

> > Maybe we need a flag to properly indicate "don't diddle with
> > this thread from userland"? But, then, mainline kernel wouldn't need
> > the current PF_THREAD_BOUND at all. Peter, Steven, what do you think?
> Strict per-cpu affinity that is needed for correctness and disallows
> sched_setaffinity() is something entirely different from not being
> allowed to put something in a cgroup.

Right, I introduced PF_THREAD_BOUND specifically so userspace could not
change the set of allowed cpus of a kthread that has used kthread_bind()
for specific affinity. Any other kthread could set that flag directly to
avoid the same tampering.

The flag was extended for cpusets to avoid having the same kthreads being
moved out of the root cpuset since cpuset.cpus can be changed for all non-
root cpusets to be disjoint. We wanted to avoid an inconsistency where
threads attached to a cpuset had disjoint cpumasks; all threads attached
to a cpuset should have cpumasks that are a subset of cpuset.cpus.

> As to not allowing to put in a cgroup thing, is there anything other
> than kthreadd for which we need to enforce that? So far I've mostly
> treated it like: root can do stupid things, this is one of them, don't
> do that then.

Certainly the stop machine migration kthreads and per-cpu watchdog
threads shouldn't be moved out of the root cpuset. Both get
PF_THREAD_BOUND from calling kthread_bind().

 \ /
  Last update: 2011-10-12 03:23    [W:0.093 / U:1.788 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site